CORS Regex Header Allow-Credentials Bug

[GeorgeDanicico]

Describe the bug

When using regex for CORS origins, it seems that when there is a match between the regex and the Origin, it seems that Access-Control-Allow-Credentials header is false, and according to the documentation it should be true. Am I missing something? This can be fixed by declaring the property, but I was just curious if it is a bug.

Expected behavior

The header Access-Control-Allow-Credentials should be true when the regex matches the Origins.

Actual behavior

If the property quarkus.http.cors.access-control-allow-credentials is not mentioned and if the regex matches the origin, the header's value is false.

How to Reproduce?

No response

Output of uname -a or ver

No response

Output of java -version

No response

Quarkus version or git rev

No response

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

[quarkus-bot]

/cc @pedroigor (bearer-token)

[gsmet]

Any chance you could prepare a small Maven reproducer for the issue? You can attach it as a zip to your description or comment. Thanks!

[GeorgeDanicico]

Sure. I have created the zip. I also attached some images with the curls. In the first image, the cors.origins is set to https://app.mydomain.com and in the second image it is set to /https://\\.*mydomain\\\\.com/


issue.zip

[gsmet]

Thanks for the reproducer. From what I can see, it looks like an oversight. I'm working on a patch.